JPCERT-AT-2019-0040 JPCERT/CC 2019-10-16 <<< JPCERT/CC Alert 2019-10-16 >>> Oracle Releases Critical Patch Update, October 2019 https://www.jpcert.or.jp/english/at/2019/at190040.html I. Overview On October 15, 2019 (local time), Oracle released critical patch updates for multiple Oracle products. Oracle Critical Patch Update Advisory - October 2019 https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html A remote attacker may cause the application to crash or execute arbitrary code by leveraging these vulnerabilities. Users of the affected products are recommended to update to the latest version appropriately. II. Affected Products Products affected by these vulnerabilities include: - Java SE JDK/JRE 11.0.4 - Java SE JDK/JRE 13 - Oracle Database Server 11.2.0.4 - Oracle Database Server 12.1.0.2 - Oracle Database Server 12.2.0.1 - Oracle Database Server 18c - Oracle Database Server 19c - Oracle WebLogic Server 10.3.6.0.0 - Oracle WebLogic Server 12.1.3.0.0 - Oracle WebLogic Server 12.2.1.3.0 However, since there are many other versions and products affected by these vulnerabilities, please refer to the information provided by Oracle for more details. In addition, there are cases where Java JRE is pre-installed on the PC or WebLogic is used in software products for servers. Please check if any of the affected products is included in the PCs or servers that you use. According to Oracle, Java SE, Java SE JDK/JRE 7 and Java SE JDK/JRE 8, are also affected by these vulnerabilities. Also, Oracle recommends users of Java SE JDK/JRE 12 to upgrade to Java SE JDK/JRE 13, as Java SE JDK/JRE 12 is no longer supported. Please refer to the following page for details. Java SE 12 Downloads https://www.oracle.com/technetwork/java/javase/downloads/jdk12-downloads-5295953.html III. Solution Oracle has released updates for each product. For Java SE, Oracle Database and WebLogic, the following versions have been released: - Java SE JDK/JRE 11.0.5 - Java SE JDK/JRE 13.0.1 - Oracle Database Server 11.2.0.4 * - Oracle Database Server 12.1.0.2 * - Oracle Database Server 12.2.0.1 * - Oracle Database Server 18c * - Oracle Database Server 19c * - Oracle WebLogic Server 10.3.6.0 * - Oracle WebLogic Server 12.1.3.0 * - Oracle WebLogic Server 12.2.1.3 * * Details of the updated versions are not available as of October 16. Please check with Oracle, etc. for the latest information. Some applications that use affected products may not run properly after updating the software to the latest version. Please update to the latest version after considering any possible impacts to applications that you may use. Java SE Downloads https://www.oracle.com/technetwork/java/javase/downloads/index.html Free Java Download https://java.com/en/download/ Users of 64-bit Windows may have 32-bit and/or 64-bit versions of JDK/JRE installed. Please check the versions installed on your system and apply the appropriate updates. Users can check the version of Java that they are using at the page below. If both 32-bit and 64-bit versions of Java are installed, please check the versions installed, using a 32-bit and 64-bit browser respectively. (In environments where Java is not installed, there may be a request to install Java. If you do not require Java, please do not install.) Verify Java Version https://www.java.com/en/download/installed.jsp IV. References Oracle Corporation Oracle Critical Patch Update Advisory - October 2019 https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html Oracle Corporation Java Development Kit 11 Release Notes https://www.oracle.com/technetwork/java/javase/11u-relnotes-5093844.html Oracle Corporation Listing of Java Development Kit 13 Release Notes https://www.oracle.com/technetwork/java/javase/documentation/13u-relnotes-5461742.html Oracle Corporation October 2019 Critical Patch Update Released https://blogs.oracle.com/security/october-2019-critical-patch-update-released Oracle Corporation Oracle Java SE Support Roadmap https://www.oracle.com/technetwork/java/eol-135779.html If you have any information regarding this alert, please contact JPCERT/CC. ====================================================================== JPCERT Coordination Center (JPCERT/CC) MAIL: ew-info@jpcert.or.jp TEL: +81-3-6271-8901 FAX: +81-3-6271-8908 https://www.jpcert.or.jp/english/